Privacy Policy

Last updated: 1 November 2026

1. Who we are

SynapseRP ("we", "us") runs this website, our FiveM roleplay server, our forum at forum.synapse-rp.net and our Discord support bot. We are the data controller for the personal data described below, and we are based in the United Kingdom. This policy explains what we collect, why, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact for anything in this policy: [email protected].

2. What we collect

  • Account details: your email address, your chosen username, and a hashed (never plaintext) version of your password.
  • Security data: for each login session, your IP address, browser/user-agent string and timestamps. We also store one-time login codes, email confirmation/reset links, and "remember this device" tokens for the in-game login.
  • Game identifiers: when you play on the server, we receive your FiveM/Rockstar licence identifiers. Our server administration tool (txAdmin) also records your IP address and FiveM hardware tokens so that bans can be enforced.
  • Gameplay data: your characters and what happens to them in game, such as money, items, vehicles, properties, factions and in-game records.
  • In-game activity log: a record, kept for moderation, of what you do on the server: when you connect, disconnect and pick a character, the commands and chat you send, and the actions you take in game (for example buying or using an item, clocking in to a job, placing furniture, sending a payment or posting in a phone app). Each entry records your licence identifier, your player and character names, the action, a short summary of what you sent with it (such as the item and amount), whether it succeeded, the time, and where your character was standing. Text longer than a few words, such as the body of an in-game phone message, mail or note, is recorded only as its length, not its content. Only staff can see this log.
  • Moderation records: bans, warnings and kicks issued to your account or licence, with the reason and the staff member who issued them.
  • Discord: if you link Discord, we store your Discord user ID only (we request the identify scope: no email and no server list). If you open a support ticket, we store your Discord ID and the messages and attachments posted in the ticket.
  • Forum content: your threads, posts and profile on the forum. The forum runs on separate software (Flarum) with its own database, and you sign in to it with this site's account.
  • Bug reports: the details, labels and image links you submit.
  • In-game phone photos: photos you take with the in-game phone camera. They are pictures of the game world, but can show your character and anything else on your screen when you take them. We store each photo on our own server together with the character that took it, its size and when it was taken. A photo is published at a web address on synapse-rp.net, so anyone with that link can view it.
  • In-game phone content: what you create through the in-game phone apps, such as Lifeinvader profiles, posts, stories, comments, likes and friend lists; Snapmatic posts; business listings, reviews, job applications and messages to businesses; websites and domains you rent in Eyefind and your browsing history there; and PayBuddy payments, payment requests and saved products. These belong to your character and are part of your gameplay data.

3. Why we use it, and our lawful basis

  • To provide the service you signed up for (contract): running your account, logging you in to the site, the game and the forum, showing you your characters on the dashboard, and handling your support tickets.
  • To keep the service secure and fair (legitimate interests): preventing account takeover, cheating, duplication exploits and ban evasion, and moderating the community. We think players reasonably expect a roleplay server to do this, and we keep the data limited to what that needs.
  • To meet legal obligations (legal obligation): for example, responding to valid requests from authorities.

We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.

4. Cookies

The website sets only strictly necessary cookies, so it does not ask for cookie consent:

  • Session cookie: keeps you signed in.
  • CSRF cookie: protects your account from cross-site request forgery.
  • Login code cookie: remembers which account is part-way through signing in while you enter your emailed code.
  • Discord link cookie: a short-lived (10 minute) cookie used only while you link a Discord account.

We do not use analytics, tracking or advertising cookies, and we load no third-party scripts or fonts.

5. Who we share it with

  • Resend delivers our emails (confirmation links, login codes, password resets). Your email address and the message content pass through them for that purpose only.
  • Discord carries support tickets, and receives staff-only moderation alerts that can include your character name and in-game identifiers.
  • ImgBB (i.ibb.co) hosts any images you link in a bug report. When staff view those images, ImgBB sees the viewer's IP address.
  • Cloudflare sits in front of this website and the in-game photo links to protect them from attacks and to speed them up. It sees the IP address of everyone who visits the site or loads a photo, and may briefly cache photos.
  • Image hosts used in game: players can show images from Discord, ImgBB or FiveManage on in-game posts, profiles, business listings and websites. When your game loads one of those images, that host sees your IP address. Photos taken with the in-game phone camera before 29 October 2026 were stored on Discord.
  • Our hosting provider runs the servers this all lives on.

Resend, Discord, ImgBB, FiveManage and Cloudflare may process data outside the UK, including in the United States. Where they do, the transfer relies on the safeguards those providers offer, such as the UK-US data bridge or standard contractual clauses.

Other players can see what you do in game and on the forum, as with any multiplayer community.

6. How long we keep it

  • Expired or revoked login sessions, used login codes, and used or expired email links are deleted automatically, shortly after they stop being useful.
  • "Remember this device" tokens for the in-game login last up to 30 days.
  • Ticket transcript links stop working 14 days after a ticket closes. Staff keep the ticket record itself as a moderation record.
  • In-game phone photos that nothing uses (a photo taken but never posted, or whose post, profile picture, logo or website was deleted) are deleted automatically after one day. A photo that is in use is kept while it is in use. Staff can delete any photo, and can stop a character from uploading. Each staff action on photos is recorded in a staff log.
  • Lifeinvader stories disappear after 24 hours and are deleted within 48 hours. Lifeinvader notifications are deleted after 30 days. Eyefind browsing history is deleted after 14 days. A website is deleted when its domain is released or has lapsed for more than 3 days.
  • The in-game activity log is deleted automatically after 30 days. If staff rely on an entry for a ban or warning, the reason they record for it is kept as part of that moderation record.
  • Moderation records (bans, warnings, kicks) are kept for as long as they are needed to enforce them and to deal with appeals.
  • Everything else is kept while your account exists, or until you ask us to delete it.

7. Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict how we use your data, or object to us using it on the basis of legitimate interests;
  • receive data you gave us in a portable format.

You can delete your website account yourself from Preferences. This removes your account, sessions, login tokens and bug reports, and stops you signing in to the forum or the game. It does not automatically remove your in-game characters, forum posts or support tickets. Email us if you want those deleted too.

For any other request, email [email protected]. We will reply within one month. We may keep data we need to enforce an existing ban, or data the law requires us to keep, and we will tell you if that applies.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Age requirement

You must be at least 16 years old to create an account or play on the server. If we learn that an account belongs to someone younger, we will delete it.

9. Security

Passwords are hashed with Argon2. Logins can be protected with emailed one-time codes. The website reads game data through a read-only database user, and access to admin tools is restricted to staff. No system is perfectly secure. If we become aware of a breach that puts your data at risk, we will tell you and the ICO where the law requires it.

10. Changes to this policy

We may update this policy. When we make a material change we will update the date above and, where appropriate, announce it on Discord or the forum.